The short version
- Coinbase data breach: Coinbase says its own systems weren’t hacked, but analytics vendor Amplitude leaked contact data for a “small subset” of its customers, with no count given.
- In Korea, Bithumb found an outsider in its internal office system on October 27 and is still checking customer data, while broker Daishin lost data on 38,490 customers.
- The crew is watching for fake support calls and emails built on the leaked names and numbers; no real exchange asks you to move coins or read out a code.
Coinbase says there was no Coinbase data breach. Its analytics vendor Amplitude was hit instead, and a “small subset” of Coinbase customers had their contact details taken. In Seoul, Bithumb found an outsider inside its internal office system the same week.
Neither exchange lost a coin. That isn’t where the danger sits. A name, a phone number and the word “Coinbase” are all a fake support caller needs. So who is exposed, and what does that call sound like?
Coinbase Support opened its statement with a denial:
Coinbase has not had a data breach.
Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.
We’ve found no evidence of unauthorized access to Coinbase systems, and
What Leaked in the Coinbase Data Breach?
Contact data, from a vendor, for an unknown number of people. Amplitude is an analytics firm: apps send it data on how users click around so product teams can see what works.
Coinbase said on X that the Amplitude incident hit Coinbase customer contact data “among other Amplitude customers,” that it found no sign of access to its own systems, and that funds were not touched. It is notifying affected users and regulators.
What it hasn’t said is how many customers, which fields or when Amplitude was breached. A figure of more than 70,000 users, shared by SlowMist’s security chief, is going around. Coinbase hasn’t confirmed it, and it sits close to the 69,461 customers in Coinbase’s 2025 insider leak. Amplitude had not commented publicly at the time of writing.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Bithumb Hack: Staff Data First, Customers Unknown
Bithumb found on October 27 that an outsider had got into its internal mobile groupware, the office system staff use for mail and messages. It reported the breach the same day to the Korea Internet & Security Agency and the Personal Information Protection Commission, MBC reported.
So far the leaked data belongs to staff at Bithumb, its subsidiaries and partner firms. Whether customer data was in there is still being checked. Bithumb says the system is cut off from trading and customer assets, and nothing that could move coins or make payments leaked.
The Bithumb hack isn’t the only one. Broker Daishin Securities said on Wednesday that 38,490 customers lost names, email and home addresses, login IDs and bank account numbers in a breach it spotted on October 17. Asset manager Mirae Asset Global Investments blocked an intrusion on some web systems. At least 20 Korean financial firms have reported cyberattacks since late September, and the Financial Services Commission called an emergency meeting with Bithumb, the regulator FSS and exchange group DAXA on Wednesday.
SIDE TRAIL: Keystone Wallet Breach: Maker to Destroy 18,835 Devices After Key Theft
How Fake Support Scams Use Leaks Like These
Every fake support scam runs on the same script, and it works. A call, text or email says there’s been a suspicious login on your account. The caller knows your name, your email, maybe your address, so it sounds real. Then comes the ask: move your coins to a “safe” wallet, read out a code, or set up a new seed phrase they “made” for you.
Coinbase scam calls are nothing new. Investigator ZachXBT counted more than $65 million taken from Coinbase users by fake support callers in December 2024 and January 2025 alone, and put the yearly toll above $300 million. Then in May 2025 Coinbase admitted bribed overseas support agents had copied customer data, refused a $20 million ransom and offered the same sum as a reward instead.
What to do now:
- Hang up on any “Coinbase” or “Bithumb” call. Open the app yourself and check there.
- Never move coins to a wallet someone else set up, and never share a seed phrase or a 2FA code.
- Treat any email with a “case number,” an “account review” or a refund offer as fake until the app confirms it.
- Switch from SMS codes to an authenticator app or a passkey.
TRAIL MAP: Protecting Your Crypto Accounts: 2FA, Passwords and Phishing
Coinbase reports third-quarter results after the US close on Thursday, so expect the Coinbase data breach that wasn’t to come up on the call. For users, the number that matters isn’t 70,000 or 38,490. It’s the one on your phone screen, and it isn’t Coinbase.
In crypto since 2016. Trades the macro picture and reads the market on the high timeframes.
More from TheCryptoMonk →
